← Security Audits

We Found a Security Flaw in CrewAI That Most Tools Would Never Catch

June 14, 2026 | Update: Already fixed, see below

The Short Version

We ran a security audit on CrewAI, a popular framework for building AI agents, and found 3 design-level security risks. No critical vulnerabilities, no remote code execution. But we found something harder to spot: a multi-step attack chain where untrusted content quietly poisons an agent's memory and later gets it to leak database data, with no obviously "vulnerable" line of code anywhere

The good news: We reported it, and CrewAI's team shipped a fix in under 24 hours.

The Scan

  • 3,320 files scanned
  • 92 seconds
  • 3 confirmed findings, highest severity: High

Result: No critical vulnerabilities, but elevated risk for production deployments handling real data

Why This Is Hard to Catch

Traditional security scanners look for things like exposed secrets, vulnerable dependencies, and injection bugs: single points of failure in a single file.

This issue isn't like that. It's a chain: content flows from an untrusted source, into memory, back out into a future prompt, into the AI's reasoning, into a tool call, into a database.

Each individual step looks completely normal. The risk only exists because of how the pieces connect across the codebase.

It required a different kind of analysis altogether, one focused on how the pieces connect, not just whether any single piece looks dangerous on its own.

What We Found

🔴 Risk 1: Agents can be “poisoned” through their own memory

CrewAI agents store things they read, documents, web pages, files, in a long-term memory database for later use. The problem: that content goes in without any filtering or trust-checking.

Why it matters: An attacker could hide instructions inside a webpage or document. If an agent reads it and stores it in memory, those hidden instructions can resurface later, in a completely different task, and the agent may treat them as legitimate context.

This is called stored prompt injection, and it's dangerous because it persists. The malicious source can be long gone, but the poisoned memory remains.

🔴 Risk 2: Agents can be tricked into running risky database queries

CrewAI has a tool that lets agents turn plain English into SQL and run it against a real database. Even in "read-only" mode, a query can still expose sensitive data, reveal schema details, or pull records that shouldn't be visible.

⚠️ The real danger: combining both

Here's the attack chain:

  1. Attacker plants hidden instructions in a public webpage or document.
  2. An agent reads it and stores it in memory.
  3. Later, the agent retrieves that memory for an unrelated task.
  4. The hidden instruction looks like normal context to the AI.
  5. The AI generates a database query based on it
  6. The query runs.

No malware. No server hack. Just untrusted content flowing into memory, then into a database tool, chained together.

There's also a multi-agent version: a poisoned agent can pass the bad instruction to a specialist sub-agent during task delegation, and that sub-agent may act on it without knowing where it came from.

The Bigger Picture: Auditability

CrewAI has good logging, but logging isn't the same as a tamper-evident, verifiable record of what an agent actually did. For healthcare, finance, legal, or government deployments, organizations may need to prove:

  • What the agent saw
  • What memory it pulled
  • What tools and data it touched
  • Whether a human approved the action
  • Whether anything was changed afterward

This auditability gap is one of the most overlooked layers in AI agent security right now.

What CrewAI Users Should Do Today

  • Filter what enters agent memory. Scan content for prompt-injection patterns before it's stored.
  • Treat retrieved memory as untrusted. Label and scope it separately from system instructions.
  • Lock down database access. Read-only credentials, table/row-level restrictions, least-privilege.
  • Require human approval for sensitive tool calls (database access, external APIs, financial actions).
  • Add a tamper-evident audit trail for every tool call, memory retrieval, and decision.

From Report to Merge in 24 Hours

We filed a GitHub issue with concrete, backwards-compatible fixes. CrewAI's team merged a fix (PR #6154) the next day:

  • ✅ Added optional content_filter hooks on memory storage to inspect and reject content before it's saved (opt-in).
  • ✅ Added optional require_approval gate on the SQL tool to confirm before queries run (opt-in).

Scan, report, fix, merge: all under 24 hours. This is the kind of responsiveness that makes continuous security auditing valuable for fast-moving frameworks.

CrewAI isn't broken. It's flexible by design, which means security is partly the application developer's job. The takeaway for anyone building with AI agents: it's not just about securing code anymore. It's about governing what agents remember, what they retrieve, what they're allowed to do, and what proof exists afterward.

This is the first entry in TrustableClaw's 2026 AI Agent Security Index. A LangChain audit has been completed and a fix has been proposed; findings will be published once it's merged. AutoGPT, AutoGen, and GPT-Researcher audits are in progress, along with audits of agent frameworks from OpenAI, Anthropic, Google, and NVIDIA.